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WHAT IS CLAIMED IS: 

1 . A method for determining a geographical region of a host in a network, 
said method comprising the steps of: 

selecting other hosts in the network such that the selected other hosts 
5 are located in a plurality of geographical regions that are determinable; 

determining, at a plurality of points in the network, first sets of 
information associated with the selected other hosts, respectively; 

determining, at the plurality of points, second sets of information 
associated with the host; and 
10 determining the geographical region of the host based on the 

geographical region of one or more of the selected other hosts whose respective mean 
of first sets of information has a shortest weighted vector distance from the second 
sets of information. 



15 2. The method of claim 1, wherein the step of determining the first sets of 

information comprises the step of: 

determining time delays in communicating with the selected other 
hosts from the plurality of points, respectively. 

20 3. The method of claim 1, wherein the step of determining the first sets of 

information comprises the step of: 

determining numbers of hops in one or more routes in the network 
from the plurality of points to the selected other hosts, respectively. 

25 4. The method of claim 1, further comprising the step of: 

determining geographical information associated with last identifiable 
routers in respective routes in the network from the plurality of points to the selected 
other hosts. 



5. The method of claim 4, wherein the step of determining the 
geographical information comprises the step of: 

determining longitudes of the last identifiable routers in the respective 

routes. 
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6. The method of claim 4, wherein the step of determining the 
geographical information comprises the step of: 

determining latitudes of the last identifiable routers in the respective 

routes. 

5 

7. The method of claim 1, wherein the step of determining the second set 
of information comprises the step of: 

determining time delays in communicating with the host from the 
plurality of the points, respectively. 

10 

8. The method of claim 1, wherein the step of determining the 
second set of information comprises the step of: 

determining a number of hops in each route in the network to the host 
from the plurality of the points, respectively. 

15 

9. The method of claim 1, further comprising the step of: 

determining geographical information associated with last identifiable 
routers in respective routes in the network from the plurality of points to the host. 



10. The method of claim 9, wherein the step of determining the 
geographical information comprises the step of: 

determining longitudes of the last identifiable routers in the respective 

routes. 



1 1 . The method of claim 9, wherein the step of determining the 
geographical information comprises the step of: 

determining latitudes of the last identifiable routers in the respective 

routes. 



30 12. The method of claim 1 , further comprising the step of: 

receiving, from the plurality of points, the first sets of information 
associated with the selected other hosts; and 
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merging the first sets of information received for each of the other 

hosts. 



13. The method of claim 1, further comprising the step of: 

5 receiving, from the plurality of points, the second sets of information 

associated with the host; and 

merging the second sets of information received for the host. 

14. The method of claim 1, further comprising the steps of: 

10 parsing names of the selected other hosts to determine geographical 

information about the selected other hosts; and 

including the determined geographical region information in the first 
sets of information. 



15 15. The method of claim 1, wherein the step of determining the 

geographical region of the host comprises the steps of: 

classifying the selected other hosts according to their respective 
geographical regions; 

determining mean vectors of the first sets of information associated 
20 with the classified selected other hosts; and 

determining Mahalanobis distances of the determined mean vectors 
from the second sets of information. 



16. The method of claim 15, further comprising the steps of: 
25 selecting one of the determined mean vectors with shortest 

Mahalanobis distance from the second sets of information; and 

determining the geographical region of the host to be same as the 
geographical region of the classified selected other hosts whose respective determined 
mean vector is the selected one of the determined means. 

30 

17. A system, comprising: 

a plurality of first processors that determine first sets of information 
associated with a plurality of first hosts located in a plurality of geographical regions 
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that are determinable, and determine second sets of information associated with a 
second host whose geographical region is unknown; and 

at least a second processor that receives the first and second sets of 
information, determines means of the first sets of information by geographical region, 
5 and determines the geographical region of the second host to be the same as the 
geographical region of the first hosts whose respective mean of first sets of 
information has a shortest weighted vector distance from the second sets of 
information. 

10 18. The system of claim 17, wherein the plurality of first processors are 

placed at different points in a network that includes the plurality of first hosts and the 
second host. 

19. The system of claim 17, wherein the first sets of information include 
15 traceroute information associated with the plurality of first hosts, respectively. 

20. An apparatus, comprising: 
a memory including, 

program code that receives first sets of information associated 
20 with a plurality of first hosts located in a plurality of geographical regions that are 
determinable, receives second sets of information associated with a second host 
whose geographical region is unknown, and determines the geographical region of the 
second host to be the same as the geographical region of the first hosts whose 
respective mean of first sets of information has a shortest weighted vector distance 
25 from the second sets of information; and 

a processor that executes the program code. 

21 . The apparatus of claim 20, wherein the first sets of information 
includes time delays and number of hops to the plurality of first hosts, as determined 

30 from a plurality of points in a network that includes the plurality of first hosts. 



22. The apparatus of claim 20, wherein the second sets of information 
includes time delays and number of hops to the second host, as determined from a 
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plurality of points in a network that includes the plurality of first hosts and the second 
host. 
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